Health data becomes PHI when it can be tied to a person inside a HIPAA relationship.

PHI is information about someone's health, care or payment for care that can identify them and is held by a HIPAA-regulated organisation. A lab result with a name is PHI at a hospital. The same number with nothing to identify the person is not. When it is stored or sent electronically it is called ePHI.

Spelled out: Protected health information.

Whether data counts as PHI decides whether HIPAA's rules apply to it at all, so it shapes your scope, your contracts and your breach exposure. The test has three parts: the information relates to past, present or future health, the care given, or payment for care; it identifies the person or could reasonably be used to; and it is created or received by a covered entity or business associate. Identifiers reach further than people expect: dates of service, ZIP codes, device serial numbers and IP addresses can all make data identifiable. Data stops being PHI when it is de-identified, either by removing the eighteen identifiers the rule lists with no actual knowledge that what remains could identify someone (safe harbour), or by an expert's documented determination that the risk is very small.

45 CFR 160.103

The definitions of health information, individually identifiable health information and protected health information, with the exclusions.

45 CFR 164.514(a) and (b)

The two de-identification methods: safe harbour and expert determination.

Your data inventory

Fields tagged as PHI decide which systems sit in HIPAA scope.

Breach assessments

Only unsecured PHI triggers the Breach Notification Rule.

Personal data under GDPR or DPDP

Those laws cover any data about an identifiable person, held by anyone in scope. PHI is narrower: health-related and tied to a HIPAA relationship.

Consumer health data

Health data held by an app that is not a covered entity or business associate is usually not PHI, though state consumer health privacy laws may apply.

• Tag fields in your schemas that would make health data identifiable, including dates and device or network identifiers.
• Keep PHI out of logs, analytics tools and error trackers unless they are covered by a BAA.
• If you de-identify, record which method you used and keep re-identification keys apart.
• Treat employment records you hold as an employer separately; they are excluded from PHI.

• GuideWhat counts as PHI?Protected health information, the identifiers, and when data stops being PHI.
• GuideThe Breach Notification RuleWhat counts as a breach, who is told, and the clocks that run.
• GuideHIPAA in the cloudShared responsibility, the BAA, and what stays with you.

Sources: 45 CFR Part 160, Section 160.103; 45 CFR Part 164, Section 164.514(a) and (b); HHS guidance on methods for de-identification of protected health information.